MacSync Stealer: Malvertising Campaign Impersonates Claude/Apple Support to Deploy macOS Infostealer

MacSync Stealer (TL-2026-2061), also tracked as MacSync Stealer, is a high-severity malware campaign, first published 2026-08-17. It has no confirmed attribution, affects Apple macOS, maps to 15 MITRE ATT&CK techniques (T1027, T1036, T1059), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-2061

Threat ID
TL-2026-2061
Also known as
MacSync Stealer, OSX.PWS.MacSync, ClaudeFix
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-17
Last reviewed
2026-08-17
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, financial services, individual consumers
Target regions
belgium, india, North America, 005 - South America
Detection rules
9
Indicators of compromise
24

Malware and tooling in MacSync Stealer

Malware and tooling: MacSync Stealer, OSX.PWS.MacSync, Custom AES-256-CBC / WebSocket-over-TLS Mach-O RAT

A malvertising campaign poisons Google search results for "How to Install Claude on a Mac," directing victims to a fake Claude.ai shared conversation impersonating Apple Support. A ClickFix-style lure tricks victims into pasting a curl command into Terminal, triggering a polymorphic zsh loader that chains through six stages to deploy MacSync Stealer, a native universal Mach-O RAT that harvests browser cookies/logins, Keychain secrets, Telegram sessions, SSH/cloud keys, and cryptocurrency wallet data while gaining Full Disk Access, Screen Recording (TCC) access, and persistent remote command execution via a LaunchAgent.

How MacSync Stealer works

MacSync Stealer is a macOS infostealer/RAT family, first publicly named around March 2026, that has been distributed through a series of ClickFix (malicious copy-and-paste) malvertising waves abusing the chat-sharing features of popular AI assistants as free, trusted-domain phishing infrastructure. Earlier waves (November 2025-February 2026) abused OpenAI's ChatGPT Atlas branding and fake Google Sites/GitHub-themed landing pages; a June 2026 wave tracked by Zscaler as "ClaudeFix" abused shared Claude.ai chat pages directly and carried Russian-language developer comments in its AppleScript payload. The wave documented here (Huntress, published 2026-08-17) poisons Google's sponsored results for "How to Install Claude on a Mac" and lands victims on a claude.ai/share conversation cosmetically dressed as joint Apple/Anthropic install instructions from a fake "Apple Support" persona.

The kill chain runs six stages. Stage 1 is a 1,442-byte polymorphic zsh wrapper (per-victim token, so the hash changes on every build) that unpacks a Base64+gzip heredoc payload. Stage 2 (`daemon_function`) runs entirely in memory, fetching Stage 3, staging exfiltrated data at /tmp/osalogging.zip, and cleaning up staging files. Stage 3 is server-side-generated AppleScript, unique per victim, that social-engineers a Full Disk Access TCC grant, extracts the Chromium "Safe Storage" AES key from the login Keychain, and harvests cookies/logins/web data from 13 Chromium-based and Gecko-based browsers plus Telegram Desktop sessions, SSH keys, AWS/Kubernetes credentials, and Keychain databases. Stage 4 installs the MacSync Stealer Mach-O RAT itself (universal x86_64+arm64, ad-hoc signed, statically linked against OpenSSL 3.6.2/Brotli) with LaunchAgent persistence disguised as a system updater (e.g. Google Keystone, Adobe ARM, Microsoft AutoUpdate), giving the operator a full interactive shell, arbitrary command execution, and file upload/download over an AES-256-CBC-encrypted WebSocket/TLS channel to a hardcoded IP with an XOR(0xAA)-obfuscated domain fallback. Stage 5 is a separately signed helper that harvests a second TCC grant (Screen Recording) via CGRequestScreenCaptureAccess and exfiltrates screenshots through the Stage 4 RAT channel. Stage 6 rewrites 60 browser wallet extensions, 21 desktop wallet apps, and 3 hardware-wallet companion apps (Ledger Wallet, Ledger Live, Trezor Suite confirmed) in place, injecting phishing UI that captures recovery/seed phrases and exfiltrates them as JSON to attacker infrastructure.

Attribution is unresolved and contested across sources: Zscaler's independent technical analysis of a related June 2026 "ClaudeFix" wave found Russian-language developer comments embedded in the AppleScript payload and assessed the operators as likely Russian-speaking and financially motivated; secondary aggregators (The Hacker News, IT Security News) have separately attributed fake-Claude-installer malvertising to DPRK-linked actors and the "Contagious Interview" cluster, but Huntress's own MacSync writeups do not make a DPRK attribution, and it is explicitly unclear whether all the ClickFix/fake-AI-installer waves (ChatGPT Atlas lure, GitHub-themed lure, ClaudeFix, this Apple Support lure) are run by the same actor. The financially-motivated, crypto-wallet-draining payload is consistent across all observed waves regardless of attribution.

MITRE ATT&CK techniques used in TL-2026-2061

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Collection

T1113 Screen Capture; T1560 Archive Collected Data

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Persistence

T1543 Create or Modify System Process

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

persistence

T1554 Compromise Host Software Binary

Command and Control

T1573 Encrypted Channel

Impact

T1657 Financial Theft

Affected products and versions in MacSync Stealer

  • Apple — macOS
    Vulnerable versions: all versions capable of running Terminal/zsh (social-engineering vector, not version-specific)

Remediation for MacSync Stealer

Immediate actions

  • Block the delivery domains agenticsora.com and malwareaudit.com and the C2 IP 85.206.161.241:8443 at the network perimeter/DNS layer
  • Hunt for LaunchAgents matching the pattern ~/Library/LaunchAgents/com.apple.<8hex>.hcpi.plist or plists impersonating Google Keystone / Adobe ARM / Microsoft AutoUpdate / Dropbox / Spotify / Grammarly / JetBrains that do not match the legitimate vendor binary
  • Search endpoint history for curl commands piping Base64-decoded content into zsh, and for osascript executions immediately followed by TCC (Full Disk Access / Screen Recording) prompts
  • Any user who ran the curl|zsh command should be treated as fully compromised: rotate all browser-saved passwords, revoke and reissue SSH keys and cloud (AWS/Kubernetes) credentials, and move cryptocurrency held in any wallet app/extension that was open on the machine to a new wallet on a clean device

Workarounds

  • No vendor patch applies — this is a social-engineering delivery vector, not a software vulnerability; mitigation is user-execution prevention and TCC-grant review, not patching

Longer-term hardening

  • Deploy EDR/behavioral detection for the ClickFix pattern (user-initiated paste-and-run into Terminal/Run dialogs) rather than relying on static hash or signature detection given the per-build polymorphism
  • Restrict or alert on ad-hoc-signed, unnotarized Mach-O binaries establishing LaunchAgent persistence
  • User awareness training specifically on ClickFix / "paste this into Terminal to fix" lures, including AI-assistant-hosted variants (shared Claude/ChatGPT/Grok conversation pages)

Timeline of MacSync Stealer

  • Earliest reported ClickFix wave delivering the MacSync malware family abuses a fake OpenAI ChatGPT Atlas lure via Google sponsored results, directing victims to fake Google Sites pages carrying the malicious Terminal command (approximate month, per The Hacker News).
  • A second wave targets "how to clean up your Mac" searches, abusing legitimate OpenAI ChatGPT shared conversations to redirect victims to malicious GitHub-themed landing pages (approximate month, per The Hacker News).
  • A variant targeting victims in Belgium, India, and North/South America introduces server-side-generated, dynamic AppleScript payloads with in-memory execution to evade static analysis (approximate month, per The Hacker News).
  • The Hacker News publishes analysis naming and tracking the "MacSync" macOS infostealer family across the ClickFix/fake-AI-installer campaign waves (approximate date).
  • Build timestamp embedded in the universal Mach-O Agent RAT binary observed in this campaign (UTC, per Huntress binary analysis).
  • Zscaler tracks a distinct wave ("ClaudeFix", active 2026-06-12 through 2026-06-19) abusing shared Claude.ai chat pages directly to deliver MacSync Stealer (detected as OSX.PWS.MacSync / HTML.Trojan.ClickFix); Russian-language developer comments are found in the AppleScript payload.
  • Huntress publishes analysis of a new MacSync wave that poisons Google search results for "How to Install Claude on a Mac" and impersonates Apple Support inside a shared Claude.ai conversation, documenting the full six-stage kill chain covered by this threat record.

Sources cited for MacSync Stealer

Threats related to MacSync Stealer

Detection coverage for TL-2026-2061

As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2061 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats